Aave DIVA Wrapper

Description

The AaveDIVAWrapper contract implements several batch functions that allow users to perform multiple operations in a single transaction. The following batch functions lack array length validation and are accessible by any user:

Each of these functions iterates through user-provided arrays without any maximum length check. For each iteration:

• batchCreateContingentPool: Creates a new pool and mints position tokens

• batchAddLiquidity: Transfers tokens, supplies to Aave, and mints wTokens

• batchRemoveLiquidity: Burns tokens and processes withdrawals

• batchRedeemPositionToken: Processes token transfers and redemptions

• batchRedeemWToken: Processes wToken burns and withdrawals

Each operation in these loops involves significant gas costs due to storage operations, external calls, and token transfers.

Impact

The lack of array length validation can lead to gas exhaustion and denial of service:

1. Transaction Failure:

   • A malicious user can call these functions with arrays large enough to exceed the block gas limit

   • The transaction will revert, making the batch functions unusable

   • Users will waste gas on failed transactions

2. Protocol Disruption:

   • Legitimate users cannot use batch functions for large operations

   • Forces users to split operations into multiple transactions, increasing costs

   • May block critical protocol operations during high activity periods

Mitigation

Add a maximum array length validation to all affected batch functions.